PDF malware analysis — malicious · c0bd69cef6db6ea5

MALICIOUS

PDF

16.6 KB Created: 2020-10-26 00:13:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: a65c3cb95480bfb81181287b059baa77 SHA-1: 16c3c96b5868222b81e5c92fb563b5c132924850 SHA-256: c0bd69cef6db6ea50a2ea5e4606471b496236545e2cd9db99ce6dfab7c6559e3

112 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF is identified as an image-only lure, typical of phishing attacks, designed to trick users into clicking a link. The embedded URL, https://ggtraff.ru/aws?keyword=bingo+en+ingles+para+imprimir+pdf, is flagged as a malicious redirector. The ML classifier also strongly indicates maliciousness, supporting the phishing attack pattern.

Machine Learning

Nyx PDF Classifier malicious score 0.9982

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 16 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ggtraff.ru/aws?keyword=bingo+en+ingles+para+imprimir+pdf
- https://cdn-cms.f-static.net/uploads/4383692/normal_5f8d604f563d8.pdf
- https://cdn.shopify.com/s/files/1/0501/6394/1541/files/dumumuz.pdf
- https://cdn.shopify.com/s/files/1/0501/0771/1653/files/middle_cranial_fossa_arachnoid_cyst_radiology.pdf
- https://cdn.shopify.com/s/files/1/0481/3655/2601/files/downward_rotation_of_scapula_muscles.pdf
- https://uploads.strikinglycdn.com/files/8ec5d1e0-f9fb-4dc5-96bc-4df194551527/can_cant_exercises_macmillan.pdf
- https://uploads.strikinglycdn.com/files/b5a6c15c-628e-4460-ade6-ac6c99276c9f/84236683387.pdf
- https://uploads.strikinglycdn.com/files/e3261a32-22c7-4ce1-ba95-7c6cb4596db7/bubivazifaropumisuv.pdf
- https://s3.amazonaws.com/fukezavazuj/artificial_neural_networks_and_machine_learning_icann_2018.pdf
- https://s3.amazonaws.com/magapeguwabe/erp_functional_consultant_resume.pdf
- https://s3.amazonaws.com/gupuso/basal_metabolic_rate.pdf
- https://s3.amazonaws.com/jiguwuzobozobaz/92431767357.pdf
- https://s3.amazonaws.com/vukumesoj/rimagikeveniro.pdf
- https://uploads.strikinglycdn.com/files/ddf392fc-3c57-4397-a589-4230b5dbc00c/xulekilefusidaxati.pdf
- https://uploads.strikinglycdn.com/files/3ee21a9d-bacb-4048-bd0d-97f0ecb1bd19/11889666001.pdf
- https://uploads.strikinglycdn.com/files/03824c05-fb68-4a95-94eb-c3a46e220077/20335819662.pdf
- https://s3.amazonaws.com/fasanag/peter_drucker_espaol.pdf
- https://s3.amazonaws.com/subud/dirositezaxukesapeluwoxu.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.